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SYSTEM AND METHOD FOR INTERFACING WITH A SYSTEM MONITOR 



BACKGROUND 

Field of the Invention 

The present invention relates generally to diagnostics in computer information 
systems. More specifically, the present invention relates to providing an interface to 
system monitors to facilitate creation and management of rule sets. 
Background of the Invention 

Computer monitors use alarms to indicate problems or error conditions with a 
running computer application. These monitor systems are commonly used on high 
availability systems and Internet servers. Monitor systems typically use rule sets to 
determine what constitutes a problem for a particular computer application. These 
rule sets are typically entered manually by an administrator, and require the 
administrator to enter each rule to be used. These rules can include message text, 
alarm behavior, files to scan and other information that the system monitor uses to 
determine how to process a particular alarm. 

Custom computer applications have different requirements for generating 
alarms in response to problems or error conditions encountered during the 
application's execution. Because such custom responses to errors or other problem 
conditions are not known to conventional system monitors, they must be manually 
entered into a rules file that a system monitor can access to determine how to handle 
particular messages. Such manual entry is inefficient and prone to error. 

Moreover, these requirements can change as an application matures. Thus, 
modification and/or enhancements to the computer application may require 
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modifications in the rule sets used by the system monitor. These modifications would 
also require manual entry using conventional systems. 
SUMMARY OF THE INVENTION 

[0005] The present invention addresses the foregoing problems in the art by 

providing an interface to a system monitor to facilitate creation and management of 
rule sets used by the system monitor. In one aspect, the present invention analyzes a 
custom computer application to be monitored and generates changes to the rule sets 
used by the monitor system. Furthermore, the present invention incorporates a 
decision support interface to customize the rules to be used by the monitor system. 

[0006] In one embodiment, the present invention is a system for interfacing to a 

system monitor. The system includes a source file corresponding to a computer 
application to be monitored. An import module in the system extracts notification 
messages from the source file and stores the notification messages in a scan file. A 
manager module in the system displays each of the notification messages stored in the 
scan file. The system can also include an export module to store data in a table in a 
format acceptable to the system monitor. 

[0007] In another embodiment, the present invention is a method for interfacing to a 

system monitor. The method includes one or more of the following steps. First there 
is a step of scanning a source file of a computer application to be monitored for one 
or more notification messages. The method continues with the step of extracting the 
notification message from the source code file. The method continues with the step 
of displaying the notification message in a graphical user interface. Next, the method 
continues with the step of displaying a modifiable severity in the graphical user 
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interface corresponding to the notification message. Next the method continues with 
the step of displaying a modifiable location where the notification messages are 
stored when generated by the computer application. The method then continues with 
the step of generating an export file in a format compatible with a system monitor, the 
export file comprising the modifiable severity and the modified location as modified 
in the previous steps. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0008] FIG. 1 is a schematic diagram of a system for providing an interface to a 

system monitor according to a preferred embodiment of the present invention. 
[0009] FIG. 2 is an exemplary mapping table for translating severity levels from a 

numerical representation to a textual representation. 
[0010] FIG. 3 is an exemplary mapping table for translating severity levels from a 

textual representation to a numerical representation. 
[001 1] FIG. 4 is a flow diagram of a preferred embodiment of an import process in 

accordance with the present invention. 
[0012] FIG. 5 is a flow diagram of a preferred embodiment of a scan process in 

accordance with the present invention. 
[00 1 3] FIG. 6 is a flow diagram of a preferred embodiment of an export process in 

accordance with the present invention 

DETAILED DESCRIPTION OF THE INVENTION 
[0014] FIG. 1 is a schematic diagram of a system 100 for providing an interface to a 

system monitor according to a preferred embodiment of the present invention. 

System 100 includes a computer 102 on which a computer application 104 is 
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executing. System 100 also includes a display 106 and storage disk 108. Disk drive 
108 is shown for purposes this description as an internal disk drive. It would be 
apparent to those skilled in the art that disk drive 108 can be an external disk drive. 
[0015] A system monitor 110 monitors application 104 by analyzing an error file 1 12 

and a warning file 1 14. Preferably, system monitor 1 10 is an application running on 
computer 102. Error file 1 12 and warning file 1 14 store error and warning log 
messages respectively. The error and warning messages are messages that would be 
generated by computer application 104 if an error event or other predetermined 
condition were to occur. 

H s [00 1 6] The present invention can include a manager for managing rule sets used by 

Cj system monitor 1 10 to process alarm conditions. In one embodiment of the present 

rj invention, the process proceeds in three stages. The first stage is an import stage, the 

J second stage is a manager stage, and the third stage is an export stage. 

M» [0017] In the import stage, as shown in Figures 1 and 4, an import module 120 scans 

s s a 

W a source code file having the source code of a computer application to be monitored. 

D In the present case, import module 120 scans source code file 118, which contains the 

source code associated with computer application 104. Import module scans source 
code file 1 18 for specific computer code that generates notification messages to 
system monitor 1 10, for example, by storage in error file 1 12 or warning file 1 14. 
Preferably, the scan is performed by searching for text indicative of error messages, 
warning messages or any other messages that are used to provide notification of 
problems with the running computer application. 
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[00 1 8] Notification messages include any message that can provide notification of a 

problem in a running application. Import module 120 can search for all such 
messages or some subset, not including all, of the notification messages. For 
purposes of clarity only, only error and warning messages are discussed in this 
description. For example, in one embodiment, import module 120 searches for text in 
quotations that begins with the text "ERROR:" or "WARNING:". 
[0019] The output of the import module 120's scan is a scan file 126. Scan file 126 

includes each unique instance of an error or warning message that is generated by the 
running application when there is a problem, or there is a condition that might result 
j in a problem. Any duplicates or error or warning messages are not stored. 

S Alternatively, duplicates of any error or warning messages are removed in a duplicate 

5 removal step performed by import module 120 after scan file 126 is initially created. 

J [0020] After scan file 126 is created and duplicates are removed, whether by a second 

U pass or as part of the initial scanning, a manager module 122 presents the contents of 

W scan file 126 in a graphical user interface (GUI) 1 16 so that they can be modified if 

F? desired. Preferably, the GUI 1 16 can be a web-enabled graphical user interface. 

Web-enabling GUI 1 16 provides for remote accessibility. Furthermore, it reduces the 
requirements of any client displaying the graphical user interface. That is, display 
106 can be hosted on a lightweight client that is distinct from computer 102. 
[0021] Manager module 122 reads scan file 126, which is generated by import 

module 120. Preferably, in a scrolling window in GUI 1 16, manager module 122 
displays a scrolling window with each line of the scrolling window corresponding to 
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a notification message stored in scan file 126. Preferably, each line of the scrolling 
window comprises three columns. 
[0022] The first column includes message text. The message text is the exact 

representation of the message as it would appear if it were generated by computer 
application 104. 

[0023] The second column includes information related to a priority or severity of an 

alarm that is generated if the message is detected by system monitor 110. For 
example, the priority or severity may be represented by a number between 0 and 99 
inclusive. A value of 0 indicates that no action is taken when the error message is 
encountered. That is, it is an error condition that can be ignored. 

[0024] Severity levels are used by the system monitor to determine how to process 

error messages. For example, the severity level can indicate who is to receive a 
report that the error message occurred, how that person is to receive the report of the 
error message, for example by pager or some other communication method and when 
the person is to receive the report of the error message, for example, immediately, or 
at some other time. 

[0025] Any number range could be used within the scope and spirit of the present 

invention. Moreover, the severity level can be represented by text. One such textual 
representation includes severity levels of "LOW", "MEDIUM" and "HIGH". 

[0026] When the notification messages are displayed in GUI 1 16, preferably they are 

assigned a default severity level. For example, where the severity levels are 
represented by a range of values from 0 to 99, the default severity level is preferably 
50. The default level can be determined by the particular system monitor used. 
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[0027] The value of the severity is modifiable. The value can be modified by a user 

of the present invention by selecting the severity level corresponding to a particular 
notification message. Preferably, this selection of the severity level that is to be 
modified is made using a pointing device, such as a computer mouse 111. 
[0028] The third column includes information related to a location to use for 

monitoring. The location is a data file that is used for logging errors, warnings or 
other notification messages that are generated by the computer application. System 
monitor 110 reads this information to determine what to monitor, that is where to find 
the notification messages output by the computer application. The location 
information is modifiable. That is, a user can select a location corresponding to a 
particular notification message and then modify that the value of the location. 
[0029] FIG. 1 illustrates an exemplary notification message table 128 according to an 

embodiment of the present invention. In this example, the notification messages in 
table 128 can have assigned severity levels in the range from 0 to 99, with a default 
value of 50. Line 1 of table 128 represents an exemplary new error message for the 
next release of computer application 104. The new error message is assigned the 
default severity level of 50. Because it is a new error message, no location is 
identified. The location must be entered for monitoring. 
[0030] Line 2 illustrates another exemplary entry in table 128. In line 2, the severity 

is modified from the default value 50 to the value 90. This indicates that an error 
message of this type is very severe, and must be handled accordingly. Consequently, 
this modification changes the emergency response behavior and diagnostics for the 
condition present when this error message is detected by system monitor 110. 
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Line 3 illustrates another exemplary table entry in table 128. In this case, 
assume that the location was originally c:\data\warning.log. As shown in FIG.l, the 
location is modified to c:\app\warning.log to maintain consistency with the error 
message location as shown in line 2. 

A user can make any desired changed as described above. When the user has 
completed the changes, the user submits the modifications for export. An export 
module 124 generates an export file 129 from the data comprising table 128. Export 
file 129 is created in a format that can be used by system monitor 110. Alternatively, 
export file 129 is created in an arbitrary format, and later converted into a format that 
can be used by system monitor 110. 

There are a variety of system monitors that can be used as system monitor 
110. Some system monitors use text descriptions to represent severity levels. Other 
system monitors use numbers to represent severity levels. A configurable mapping 
mechanism translates the representation of the severity level into a format acceptable 
for the particular system monitor being used. 

For example, if severity levels are described numerically in table 128, but 
represented textually in the system monitor being used, a mapping table is created to 
translate the numerical representation of table 128 to the textual representation 
compatible with the system monitor. An exemplary table 200 for translating severity 
levels from a numerical representation to a textual representation is illustrated in FIG. 
2. In the example shown in FIG. 2, notification messages assigned a severity level of 
0 to 33 in table 128 are translated to a severity level of LOW for the system monitor 
that used textual severity levels. Notification messages assigned a severity level of 34 
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to 66 in table 128 are translated to a severity level of MEDIUM for the system 
monitor that used textual severity levels, notification messages assigned a severity 
level of 0 to 33 in table 128 are translated to a severity level of HIGH for the system 
monitor that used textual severity levels. 

[0035] FIG. 3 illustrates an exemplary translation mapping table 300 for severity 

levels that are described textually in table 128, but represented numerically in the 
system monitor being used. In the example shown in FIG. 3, notification messages 
assigned a severity level of LOW in table 128 are translated to a severity level of 15 
for the system monitor that uses numerical severity levels. Notification messages 
assigned a severity level of MEDIUM in table 128 are translated to a severity level of 
50 for the system monitor that used textual severity levels. Notification messages 
assigned a severity level of HIGH in table 128 are translated to a severity level of 84 
for the system monitor that used textual severity levels. 

[0036] FIG. 4 is a flowchart of an import method 400 for performing the import stage 

according to a preferred embodiment of the present invention. The method illustrated 
in FIG. 4 can be performed, for example, by import module 120. Import method 400 
includes the step of scanning a source file for notification messages in step 402. The 
source file corresponds to the computer application to be monitored. Import method 
400 continues in step 404 with the step of extracting notification messages from the 
source file. Import method 400 stores the notification messages in a scan file in step 
406. In step 408, import method 400 removes any duplicate notification messages 
from the scan file. 
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[0037] FIG. 5 is a flowchart of a manager method 500 for performing the manager 

stage according to a preferred embodiment of the present invention. The method 
illustrated in FIG. 5 can be performed, for example, by manager module 122. Import 
method 500 includes the step of reading the scan file in step 502. In step 504, 
manager method 500 continues with the step of creating a table using each 
notification message stored in the scan file. Preferably, the table includes three 
columns, a notification message column, a severity level column and a location 
column. Preferably, values in the severity level and location columns are modifiable. 
These columns are described above with reference to FIG. 1. Manager method 500 
continues in step 506 with the step of displaying each line of from the scan file in a 
scrolling window in a GUI. In step 508, manager method 500 continues with the step 
of accepting changes to the values stored in the table. In step 510, manager method 
500 continues with the step of submitting the table for export. 
[0038] FIG. 6 is a flowchart of an import method 600 for performing the import stage 

according to a preferred embodiment of the present invention. The method illustrated 
in FIG. 6 can be performed, for example, by export module 124. Import method 600 
includes the step of translating the submitted table into a format that is acceptable to 
the system monitor that is used to monitor the computer application in step 602. 
Translation can include the steps of mapping the severity level from a numerical 
representation to a textual representation and vice versa. Export method 600 
continues in step 604 with the step of creating an export file that comprises data from 
the table in a format that is acceptable to the system monitor. 
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The foregoing disclosure of the preferred embodiments of the present 
invention has been presented for purposes of illustration and description. It is not 
intended to be exhaustive or to limit the invention to the precise forms disclosed. 
Many variations and modifications of the embodiments described herein will be 
apparent to one of ordinary skill in the art in light of the above disclosure. The scope 
of the invention is to be defined only by the claims appended hereto, and by their 
equivalents. 

Further, in describing representative embodiments of the present invention, 
the specification may have presented the method and/or process of the present 
invention as a particular sequence of steps. However, to the extent that the method or 
process does not rely on the particular order of steps set forth herein, the method or 
process should not be limited to the particular sequence of steps described. As one of 
ordinary skill in the art would appreciate, other sequences of steps may be possible. 
Therefore, the particular order of the steps set forth in the specification should not be 
construed as limitations on the claims. In addition, the claims directed to the method 
and/or process of the present invention should not be limited to the performance of 
their steps in the order written, and one skilled in the art can readily appreciate that 
the sequences may be varied and still remain within the spirit and scope of the present 
invention. 
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